CODEWITHSUNDEEP
splunk
user1883212
user1883212

Reputation: 7849

How to simplify Splunk search with duplicated query statements

I wrote the following Splunk search that I plan to use for an alert:

 index=* earliest=-1h source="*video-bic*.log" "Get video" |
 dedup videoid | stats list(videoid) as l_videoid | 
 appendcols [search index=* earliest=-1h source="*video-bic*.log" "Get video" |
 dedup videoid | stats count(videoid) as num_msgs] | 
 table num_msgs, l_videoid

It works but I would like to simplify it, so that I don't have to repeat this part of the query twice:

 index=* earliest=-1h source="*video-bic*.log" "Get video"

Any ideas?

Upvotes: 0

Views: 174

Answers (1)

RichG
RichG

Reputation: 9906

The stats command accepts multiple arguments.

index=* earliest=-1h source="*video-bic*.log" "Get video" 
| stats values(videoid) as l_videoid, dc(videoid) as num_msgs
| table num_msgs, l_videoid

For better efficiency, I removed the dedup command and replaced the list and count functions with values and dc (distinct_count), respectively.

Upvotes: 1

Related Questions